Cybersecurity glossary

This glossary collects the terms that recur in our services and in Italian and European cybersecurity regulations, with the definition we use in our documents and reports. Where a term has a precise legal meaning, the definition follows it, not the commercial use made of it.

Last reviewed: 9 September 2026.

Attack Surface Management (ASM)

The continuous detection of everything an organization exposes on the Internet, such as domains, subdomains, services, certificates and portals, including what nobody remembers switching on. It differs from vulnerability assessment because it answers “what is reachable”, not “how vulnerable it is”. Read more

Chain of custody

The uninterrupted documentation of who had access to a piece of digital evidence, when and with which tools. It is what makes a forensic copy admissible: without it, the analysis remains technically valid but open to procedural challenge. Read more

Party-appointed technical consultant

The expert who assists one of the parties in proceedings: they review the work of the court-appointed consultant or expert, raise observations and produce their own report. It is the role a digital forensics lab most often plays, on behalf of a law firm. Read more

Court-appointed technical consultant

The expert appointed by the judge in civil proceedings to carry out examinations that require specialist skills. They answer to the judge, not to the parties. Read more

Data breach

A security breach that leads to the destruction, loss, alteration, disclosure of or unauthorized access to personal data. It is not the same as a “successful attack”: even an email sent by mistake to the wrong recipient is a data breach. Read more

DKIM

The cryptographic signature applied to outgoing messages, which lets the recipient verify that the content has not been altered and that it comes from a sender authorized for that domain. Read more

DMARC

The rule published in DNS that tells recipients how to treat messages that fail SPF and DKIM, and that returns reports on who is sending in the domain’s name. In monitoring-only mode it collects data but does not protect: it protects when the policy rejects unauthenticated messages. Read more

DPO: Data Protection Officer

The role that monitors compliance with data protection rules, informs and assists the controller and is the contact point with the supervisory authority. It does not decide the purposes and means of processing: that responsibility stays with the controller and cannot be delegated. Read more

EDR: Endpoint Detection and Response

The technology that observes the behavior of processes on devices and records their activity, so as to detect a suspicious sequence even when the file is not on any list of known threats. It differs from antivirus, which compares files with already catalogued signatures. Read more

Gap analysis

The structured comparison between the current state and a set of requirements, regulatory or from a standard, which produces the list of gaps and a remediation plan ordered by risk. It is the typical starting point of a compliance project. Read more

Hash

A file’s digital fingerprint: a string that changes if even a single bit changes. In forensics it is used to prove that the acquired copy is identical to the original and has not been altered after acquisition. Read more

Significant incident

Under NIS2, an incident that exceeds defined impact thresholds and triggers the obligation to notify the competent authorities through a staged procedure. Qualifying it is a documented decision, not an impression. Read more

Italian Law 48/2008

The law ratifying the Budapest Convention on Cybercrime, which introduced into Italian law the obligation to preserve the integrity of digital data and to guarantee the repeatability of operations. It is the reference for forensic acquisition methods. Read more

NIS2

The European directive on the security of network and information systems, transposed in Italy by Legislative Decree 138/2024, which extends risk management obligations to a much wider range of entities than before and assigns responsibility to management bodies. Read more

OSINT: Open Source Intelligence

The collection and analysis of publicly accessible information to reconstruct what an attacker can know about an organization without breaching any access control. The line is clear: consulting a public source is OSINT, using leaked credentials to get in is not. Read more

Penetration test

A simulated attack carried out manually by an analyst to prove which vulnerabilities can actually be exploited and what can be obtained from them. It differs from automated scanning, which lists possible vulnerabilities without verifying them. Read more

Digital forensic examination

The technical examination through which digital data is acquired, analyzed and documented in a verifiable way, so that it can be used as evidence. Strictly speaking a court expert examination is ordered by the judge; the report drawn up on behalf of a party is a party-appointed technical consultancy. Read more

Phishing

A message built to lead the recipient to give away credentials, authorize a payment or run an attachment. In its targeted variant it shows no suspicious technical indicators: it often comes from a legitimate, compromised account, with a credible tone and an urgent request. Read more

Red teaming

The exercise that simulates a real adversary with defined objectives, testing not only technical vulnerabilities but also the organization’s ability to notice and react. It assumes an already mature posture: on a perimeter not yet mapped it yields less than an assessment. Read more

Remediation

The work of fixing the vulnerabilities found, ordered by actual risk and not by number of findings. The subsequent retest is what proves the fix worked. Read more

SOC: Security Operations Center

The function that continuously monitors signals from systems and networks, correlates them and separates noise from the event that requires action. Without oversight, detection technologies produce alerts that nobody reads. Read more

SPF

The DNS record that lists the servers authorized to send mail for a domain. Without it, anyone can send messages that appear to come from that domain. Read more

Supply chain (risk)

The risk that comes from suppliers and third parties with access to the organization’s systems or data. NIS2 addresses it explicitly: the security of your suppliers becomes part of the obligations of the regulated entity. Read more

Vulnerability assessment

The systematic assessment of the vulnerabilities present on a defined perimeter, classified by severity and with a remediation plan. It covers more surface than a penetration test at less depth: it is the starting point when the perimeter is not yet mapped. Read more